By Tom Whitfield

Cysic suspended its cross-chain bridge on Saturday after an attacker exploited a message-processing flaw to mint 10 million CYS on BNB Smart Chain, the project said in a Sunday incident report on X. The company attributed the exploit to unauthorized access to a database supporting the bridge.

The mint occurred at 12:31:38 UTC on Saturday. Cysic added the recipient address to the token contract's blacklist at 13:47:52 UTC — roughly 76 minutes later. About 2.8 million of the minted CYS remained at that address, with transfers restricted, according to the report.

The company stressed the scope of the damage. "The incident did not result in the theft or unauthorized transfer of existing CYS or other assets held in user wallets," Cysic said. The incident was limited to bridge message processing and minting, and did not affect the mainnet or other operational systems.

How large is the actual loss?

Cysic cautioned that the 10 million token figure does not establish a dollar loss. Token transfers, swaps and realized losses remain under review. The gap between the mint size and the final impact will depend on how much of the unauthorized supply the attacker moved before blacklisting — a window of just over an hour.

Roughly 7.2 million CYS of the minted amount left the recipient address before transfers were restricted, based on the balances Cysic disclosed. The project has not yet published an estimate of swap proceeds or secondary-market sales.

CYS coordinates incentives for users, compute providers, governance participants and contributors in Cysic's network, according to the project's tokenomics documentation. An unauthorized inflation of the token supply therefore carries direct consequences for the project's incentive accounting, not just its bridge infrastructure.

What happens next?

Cysic has hired a security firm and plans to publish a follow-up report once the current investigation phase concludes. The bridge remains suspended in the interim, cutting off the token's primary cross-chain path until the review completes and the processing flaw is patched.

The company faces a disclosure test in the weeks ahead: converting a 76-minute on-chain timeline into a verified loss figure, and demonstrating that the database access vector cannot be repeated against remaining bridge infrastructure.